CVE-2020-25219

NameCVE-2020-25219
Descriptionurl::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2372-1, DSA-4800-1
Debian Bugs971394

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libproxy (PTS)bullseye0.4.17-1fixed
bookworm0.4.18-1.2fixed
trixie0.5.9-1fixed
forky, sid0.5.11-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libproxysourcestretch0.4.14-2+deb9u1DLA-2372-1
libproxysourcebuster0.4.15-5+deb10u1DSA-4800-1
libproxysource(unstable)0.4.15-15971394

Notes

https://github.com/libproxy/libproxy/issues/134
https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e116e2bfbe0
Search for package or bug name: Reporting problems